On March 4, 2018, a former GRU colonel named Sergei Skripal was found slumped on a park bench in Salisbury, England, next to his daughter Yulia. Both were unconscious. Both were foaming at the mouth. The substance that poisoned them — smeared on the front door handle of Skripal’s home — was Novichok, a Soviet-developed nerve agent with a lethal dose measured in milligrams. Skripal had been a double agent for British intelligence during the 1990s and early 2000s, was imprisoned in Russia in 2006, and had been released to the UK in a 2010 spy swap. Both Skripals survived. A police officer who responded to the scene was hospitalized. Four months later, a man named Charlie Rowley found a discarded perfume bottle in a charity bin in nearby Amesbury, gave it to his partner Dawn Sturgess, and Sturgess died from Novichok exposure. The two Russian operatives British police identified as responsible — operating under the names Alexander Petrov and Ruslan Boshirov — went on Russian state television to claim they had traveled to Salisbury as tourists to see the cathedral’s 123-meter spire. Within weeks, the investigative site Bellingcat had identified them as Alexander Mishkin, a military doctor, and Anatoliy Chepiga, a decorated special forces colonel — both members of GRU Unit 29155. The unit had existed since at least 2008. Its existence had never been publicly confirmed before.
What Unit 29155 is
Unit 29155 is a subdivision of the GRU — Russia’s military intelligence directorate, now formally called the GU but still referred to by its Cold War abbreviation — specialized in foreign assassination, sabotage, and destabilization operations. It operates from the headquarters of the 161st Special Purpose Specialist Training Center in eastern Moscow. Its members are drawn from GRU special forces veterans of Russia’s wars in Afghanistan, Chechnya, and Ukraine. It was commanded, through most of the period it has been publicly documented, by Major General Andrei Vladimirovich Averyanov — a man whose daughter’s 2017 wedding photos, obtained by The New York Times in 2019, show him posing alongside Chepiga, the Skripal operative who had been given the Hero of the Russian Federation, Russia’s highest honor.
The unit’s operational profile is distinct from the GRU’s other cyber and signals intelligence units. Unit 29155 does human operations — sending officers across borders on false passports to conduct assassinations, detonate ammunition depots, and destabilize foreign governments. The unit’s existence only became publicly known in 2019, eleven years after it is believed to have begun operating. Its tradecraft, according to the security officials who study it, is notable for its sloppiness — a pattern of operations that either fail outright or succeed despite leaving trails the unit apparently didn’t believe anyone would follow.
The operational record
The documented case history, compiled by Bellingcat, Czech intelligence, British authorities, The Insider, and multiple European intelligence services working from open-source data, includes operations across at least eight countries over more than a decade.
In 2014, during Russia’s annexation of Crimea and the outbreak of war in eastern Ukraine, Unit 29155 operatives were deployed to eastern Czechia. On October 16, 2014, ammunition warehouses at Vrbětice exploded. Two Czech citizens were killed. A second explosion followed in December. The Czech government initially treated the blasts as industrial accidents. Seven years later, on April 17, 2021, Czech Prime Minister Andrej Babiš announced that Czech counterintelligence had determined Unit 29155 was responsible — and that the operatives involved were the same men wanted in Britain for the Skripal poisoning, including Chepiga and Mishkin. The motive, reconstructed by investigators, was operational: the Vrbětice warehouses stored munitions belonging to Bulgarian arms dealer Emilian Gebrev, scheduled for delivery to Ukraine, which desperately needed them to fight Russia-backed separatists. The GRU was destroying weapons bound for Russia’s adversary in an undeclared war.
In April 2015, Gebrev — the Bulgarian arms dealer whose munitions had been in the Vrbětice warehouses — was poisoned in Sofia. A substance was smeared on the handle of his car. He was hospitalized alongside his son and an employee. Released from the hospital, he was poisoned again with the same substance and survived. Bulgarian investigators identified at least eight Unit 29155 officers who had traveled to Bulgaria in the weeks surrounding the attack, including the man British authorities later identified as the commander of the Skripal team — Denis Sergeev, operating under the alias Sergei Fedotov. Three Russians were eventually charged. The case, according to The Times, became the “Rosetta Stone” that let Western intelligence services decode Unit 29155’s operational pattern after the Skripal attack three years later.
In October 2016, Montenegro’s government announced it had foiled a coup attempt on the day of the country’s parliamentary elections. The plan, according to Montenegrin prosecutors: occupy the parliament building, assassinate Prime Minister Milo Đukanović, and prevent Montenegro from joining NATO. Fourteen people were charged, including Russian citizens. Two — Eduard Shishmakov and Vladimir Popov — were identified as Unit 29155 operatives. Both were convicted in absentia in 2019.
In October 2018, Dutch officials caught four GRU officers in a rented car outside the headquarters of the Organisation for the Prohibition of Chemical Weapons in The Hague, attempting to hack into the organization’s Wi-Fi network. The OPCW was investigating the Novichok used to poison Skripal. At least one of the operatives has been linked to Unit 29155.
Parallel operations have been documented or credibly alleged in Moldova (a 2014 destabilization campaign), France (15 operatives tracked visiting the Haute-Savoie region between 2014 and 2018), Switzerland (surveillance of World Anti-Doping Agency investigators in 2016-2017), and Spain (possible destabilization operations during the 2017 Catalonia independence referendum). In April 2024, a joint investigation by 60 Minutes, Der Spiegel, and The Insider alleged that Unit 29155 was connected to cases of “Havana syndrome” — the neurological symptoms reported by U.S. diplomats and intelligence officers in multiple countries since 2016. The Kremlin denied the allegations. The U.S. National Intelligence Council’s 2023 assessment concluded that adversary involvement was “unlikely.” The investigation disputed the assessment.
The tradecraft failures
The detail that makes Unit 29155 distinctive in the history of foreign intelligence services is how badly it operates. The two Skripal operatives used passport numbers that were sequential — four digits apart — suggesting they had been issued in a batch from a GRU-controlled office rather than produced through normal passport-issuance channels. Their cover identities could be penetrated by cross-referencing travel records with Russian databases that Bellingcat and its collaborators could access online. The perfume bottle containing Novichok was discarded where a Salisbury resident could find it, resulting in the death of a British citizen who had no connection to the operation. The 2017 Chechen guerrilla hit failed when the target’s wife shot the assassin. The Montenegro coup was rolled up on the day of the elections. The OPCW hack was caught in the parking lot.
The sloppiness is so consistent that some Western intelligence analysts have concluded it is not entirely accidental. Moscow’s willingness to conduct operations that can be traced back to the Russian state, with operatives who receive state awards and whose handlers appear in family wedding photographs, signals a particular kind of message: the operations are deniable in the formal diplomatic sense, but the authorship is not supposed to be invisible. The targets — dissidents, journalists, arms dealers supplying Ukraine, NATO candidate countries — are meant to understand who is coming for them. The deterrent function requires attribution. The operational failures are embarrassing. The structural message — Russia reaches its enemies wherever they are — is preserved by the attribution itself.
Why Unit 29155 is Lecture 24
Unit 29155 is the final lecture of the Shadowcraft course because it’s the most current case study and the most operationally straightforward. The course’s earlier lectures — United Fruit, the British South Africa Company, BCCI, P2, the Vatican Bank — document covert power operating through commercial, financial, or institutional intermediaries. Unit 29155 operates through officers traveling on false passports with vials of nerve agent. The mediation layer is thin. The state is directly conducting the operations.
But the structural logic is the same. Operation Gladio maintained Cold War paramilitary networks for purposes beyond their stated defensive mission. Wagner Group provides Russia’s state with deniable violence in theaters where direct military involvement would be politically costly. Unit 29155 provides deniable violence in theaters where even Wagner’s presence would be too visible — London, Salisbury, Sofia, Prague, Podgorica. Each institution fills a different rung on the deniability ladder. The Safari Club outsourced covert operations to allies. Western Goals outsourced surveillance to a nonprofit. Unit 29155 doesn’t outsource. It does the work in-house, sloppily, and relies on the formal deniability of state denials to maintain the architecture that lets the state keep denying.
We cover Unit 29155 alongside Crypto AG, Mossack Fonseca, China Poly Group, and 20 other case studies of covert institutional power across our Shadowcraft course — where the final lecture is about a unit whose tradecraft fails often enough that it proves a harder point: the failures are visible because the attributions are the point.